Back to blog
    Security

    Is Plushly Safe? Security, Privacy, and How Your Data Is Handled

    5 min read

    If you're handing a tool your resume, email access, and LinkedIn login, "is it safe" is a completely reasonable first question. Here's exactly how Plushly handles your data, in plain language rather than legalese.

    The short version

    • Data is encrypted in transit and at rest (standard TLS and database-level encryption)
    • Credentials (when needed) are stored in an isolated secrets vault — never in the main app database
    • We never sell your data to third parties or train public models on your resume
    • You can delete your account and everything associated with it at any time from the settings page

    What data we actually collect

    To do its job Plushly needs: your resume, your contact info, your job preferences, and an email address where confirmation emails can land. Optionally you can connect a LinkedIn session so Easy Apply works; that's stored as an auth token, not a password.

    We also log each application that's submitted so you can see what went out. That log is private to your account.

    How your resume is handled

    Your master resume lives in your account. The AI reads it to generate tailored variants per application. Those variants are sent to the employer's ATS — that's the whole point. They are not published, sold, or shared with anyone else.

    We do not use your personal data to train public AI models. The AI used to generate resume variants is scoped to your account's context only.

    LinkedIn and credential handling

    For LinkedIn Easy Apply, Plushly needs an authenticated session. We use a token-based approach rather than storing a raw password — the token can be revoked from LinkedIn at any time and cannot be used to log in to other services even if exposed.

    The token is stored in a secrets vault separate from the main app database, with its own access policy. Engineers do not have routine access to it.

    Account deletion

    Settings → Delete Account removes your profile, resume, application history, and any stored tokens. We keep minimal billing records where legally required (tax, audit). You'll get an email confirming deletion.

    What about the "Plushly scam" searches

    Plushly is a real company with a real team, real investors, and a real product. You can verify that on our about page and company records. The reason "is X a scam" searches exist for every auto-apply tool is that a couple of the older ones earned 2-star ratings by overpromising and undercharging refunds — which is one reason we built Plushly with a real free tier instead of a hard paywall.

    Our security page

    For specifics on infrastructure, encryption algorithms, and incident response, see plushly.ai/security. For the full privacy policy see plushly.ai/privacy.

    If you have specific security questions we haven't answered, email us at security@plushly.ai.

    All posts